An adversarial website, such as a malware attack site, may seek to cloak the presence of the malware from defensive software. The adversarial website may seek to identify protective reconnaissance and provide a less threatening content to this reconnaissance to prevent detection. A request from a compromised client may be provided with an innocent response, while a request from an unknown client may be provided with malware.